unauthorized_client: The client does not exist or is not enabled for consumers

Question

Hey all, hopefully someone could help me (/ us) out here.

First of all what we try to accomplish: We have a web app built in NextJS that uses Azure B2C for login. This works fine. We would like to allow users to login through identity providers (Microsoft and Google) where Microsoft IDP also specifically allow external tenants. This last point is a pain.

The flow we use:

• App reg in B2C
• App reg in main Azure AD tenant with fallback to B2C (.../oauth2/authresp and .auth/login/aad/callback both because which one we should have... i dont even know at this point)
• App reg in main AD accepts multitenant + personal
• In B2C app reg setup Microsoft ISP with client id and secret

Then test the B2C App:

• When logged in on your edge browser and want to use a work account; forget about it, you have no option to switch here
• When using another browser like chrome or incognito and use work "That Microsoft account doesn't exist. Enter a different account or get a new one." While it most certainly exists because I use it for work every single day

It's so ironic that setting up Google IDP (and any other auth provider) in Microsoft is easier than setting up Microsoft IDP in Microsoft. We have had so much issues with Microsoft auth (mostly separate from B2C but this tops it all)

There are plenty of people online with the same error but all fixes are about allowing personal accounts which is NOT what we are trying to accomplish. Rather have no option for personal but only allow multitenancy but then we get the error from the title.